slackhq/nebula v1.11.1

Release v1.11.1

on GitHub

See the v1.11.1 milestone for a complete list of changes.

Changed

• IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now
  classified as that protocol with no ports, closing a firewall bypass where a crafted payload could steer
  the classifier into reading one as TCP/UDP and matching a TCP/UDP rule. These packets are now matched as
  their true protocol, so only a proto: any rule allows them. If you carry one of these protocols over the
  overlay, confirm a proto: any rule covers it before upgrading, it may have been passing only through this
  bypass. (#1840)
• Drop the dependency on github.com/cyberdelia/go-metrics-graphite, which has been unmaintained for over ten
  years, by inlining the small amount of code Nebula used. (#1832)

Fixed

• The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used
  for conntrack was never picked up. (#1840)
• Enforce outbound message counter limits so a tunnel is rehandshaked before the counter can wrap, preventing
  nonce reuse. This is unreachable in practice, but is enforced as a defense-in-depth measure. (#1841)
• Prevent nebula-cert ca from running out of memory on 32bit systems when generating encrypted private keys. (#1834)
• Tolerate ErrDumpInterrupted when listing tun addresses on Linux, so a transient interrupted netlink dump
  no longer aborts startup. (#1835)